Turkey: technology regulation at a glance

Framework: Law No. 7518 of 2 July 2024 amending the Capital Markets Law No. 6362, with secondary Communiqués III-35/B.1 (establishment/operating principles) and III-35/B.2 (operating procedures and capital adequacy) published 13 March 2025 by the Capital Markets Board (CMB/SPK). CBRT Regulation of 16 April 2021 prohibiting the use of crypto assets for payments remains in force. MASAK oversees AML.

Turkey has moved from a payments ban to a comprehensive licensing regime for crypto-asset service providers (CASPs). Law No. 7518 (July 2024) put crypto platforms, custodians and other CASPs under CMB authorisation; the secondary rules issued in March 2025 fixed capital, governance, IT, custody and reporting requirements, with a transition deadline of 30 June 2026 for existing platforms to obtain their operating licence. Crypto trading, holding and investment are legal, but using crypto for payments has been banned since 2021 and unlicensed platforms have been blocked since mid-2025.

Framework: National AI Strategy 2021-2025 (updated 2024-2025 Action Plan); AI-specific bills pending in the Grand National Assembly (Kanun Teklifi 2/3358, Nov 2025); existing coverage via Law No. 6698 (KVKK/Personal Data Protection Law) and Law No. 5651 (Internet Regulation); enforcement by KVKK and BTK

Turkey has no enacted comprehensive AI law as of May 2026; multiple AI-specific amendment bills submitted to the Grand National Assembly in late 2025 remain under legislative review. Existing sectoral coverage is provided by data-protection law (KVKK) and internet-content regulation (Law 5651/BTK), supplemented by a National AI Strategy and November 2025 KVKK guidelines on generative AI. A December 2025 presidential decree also formally institutionalised AI governance by renaming and expanding the remit of the National Technology Directorate.

Framework: Law No. 6698 on the Protection of Personal Data (KVKK), enforced by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and its Personal Data Protection Board, Ankara

Türkiye has had a comprehensive personal data protection regime since Law No. 6698 (KVKK) entered into force in 2016, modelled closely on the EU GDPR. The law was substantially amended in 2024 (effective June 1, 2024; cross-border transfer rules effective September 1, 2024) to further align with GDPR by introducing SCCs, BCRs, broadened adequacy decisions, and new legal bases for special-category data. As of May 2026, Türkiye has not received an EU adequacy decision, so cross-border transfers to the EU must rely on SCCs, BCRs, or other safeguards.

Framework: Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions (2013, as amended); supervised by the Central Bank of the Republic of Türkiye (CBRT/TCMB) for payment/e-money, and the Capital Markets Board (SPK/CMB) for crypto assets

Turkey operates a mature, comprehensive licensing regime for digital payments and e-money under Law No. 6493, with the CBRT as the sole licensing and supervisory authority since 2020. Payment institutions and electronic money institutions must hold CBRT-issued operating licences, open banking services are integrated into the same framework, and an instant-payment rail (FAST) has been live since 2021. A separate CMB licensing regime for crypto-asset service providers came into force in March 2025, with transition deadlines through June 2026.

Framework: Turkish Ministry of Culture and Tourism / GoTürkiye Digital Nomad Visa Programme (launched April 2024); Presidency of Migration Management (Law No. 6458 on Foreigners and International Protection) for short-term residence permits; Ministry of Environment and Urbanisation for citizenship-by-investment

Turkey launched a dedicated Digital Nomad Visa in April 2024, administered via the GoTürkiye platform, available to nationals of 32 specific countries aged 21-55 who earn at least USD 3,000/month and hold a university degree. The visa grants a one-year residence permit (renewable once) and covers both remote employees of foreign companies and self-employed freelancers. Applicants who do not qualify for the DNV may alternatively apply for a standard Short-Term Residence Permit, which allows up to two years of stay without formal work authorisation.

Framework: Law No. 5651 on Regulation of Publications on the Internet (as amended 2020, 2022, 2025, 2026); Cybersecurity Law No. 7545 (2025); regulated by the Information Technologies and Communication Authority (BTK)

Turkey operates a densely layered internet regulation regime anchored in Law No. 5651, which grants the BTK sweeping powers to block content and throttle platforms without prior judicial review. Successive amendments have expanded platform obligations, introduced a social media ban for children under 15 (in force November 2026), and the 2025 Cybersecurity Law added broad data-access and criminal-penalty provisions. Freedom House scored Turkey 31/100 in Freedom on the Net 2025, placing it among the worst performers globally for online freedom.

Framework: Cybersecurity Law No. 7545 (in force 19 March 2025); Cybersecurity Presidency (Siber Güvenlik Başkanlığı, est. Presidential Decree No. 177, 8 January 2025); Personal Data Protection Law No. 6698 (KVKK)

Turkey enacted its first comprehensive, standalone cybersecurity law, Law No. 7545, published in Official Gazette No. 32846 on 19 March 2025. The law creates a unified regulatory authority (the Cybersecurity Presidency), mandates incident reporting without delay for all in-scope entities, and imposes heightened obligations on critical infrastructure operators in sectors such as energy, finance, healthcare, and telecommunications. It complements the pre-existing Personal Data Protection Law No. 6698 (KVKK), which separately requires 72-hour data-breach notification to the Data Protection Board.

Framework: Foreign Direct Investment Law No. 4875 (2003) and Turkish Commercial Code No. 6102 (TCC), administered via MERSIS (Central Registry Record System) under the Ministry of Trade

Turkey grants foreign investors equal treatment with domestic investors under FDI Law No. 4875, permitting 100% foreign ownership in most commercial sectors without prior governmental approval. Company formation is handled through the MERSIS online system and can be completed in 5-10 business days once documents are ready. Minimum capital thresholds are modest, TRY 50,000 for an LLC and TRY 250,000 for a joint-stock company, and the overall regime is among the more open in the region.